Vulnerability response optimization method and system based on dynamic risk assessment

Abstract

The invention discloses a vulnerability response optimization method and system based on dynamic risk assessment. The method comprises the following steps: obtaining function level data of a target system, identifying a function logic path and constructing a function response dependency graph; setting an execution monitor of the instance method, and identifying a real-time function response path in actual use of the system; performing path analysis on the real-time response path based on the function dependency graph, determining function response deviation, performing function vulnerability risk assessment, and generating a risk assessment result; and analyzing a vulnerability influence range based on a risk assessment result, and formulating a vulnerability response strategy according to the vulnerability influence range. According to the method, dynamic assessment of the function vulnerability risk in system operation is realized, the accuracy and timeliness of vulnerability response are improved, and the security risk of the system is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of attack and defense vulnerability mining, and in particular to a vulnerability response optimization method and system based on dynamic risk assessment. Background Art

[0002] Timely response and repair of vulnerabilities are crucial to ensuring the security and stability of the system. However, traditional vulnerability response methods mainly rely on static analysis and fixed response processes, and cannot dynamically adapt to changes in risks during the actual operation of the system, resulting in low response efficiency, high false alarm rate, and delayed repair, which may eventually bring serious security risks to the system.

[0003] Current vulnerability response technologies usually detect system vulnerabilities through scanning tools, penetration testing, and other methods. However, due to the complex system structure and numerous functional modules, there are often complex dependencies between different functional modules. Simple vulnerability detection and repair methods may not accurately assess the propagation path and impact range of the vulnerability. Traditional methods cannot timely perceive functional deviations that occur during system operation, resulting in vulnerabilities that may not be responded to in a timely manner or handled incorrectly, increasing the security risk of the system.

[0004] Most existing dynamic risk assessment methods remain at the data collection and analysis stage, lacking an in-depth understanding of the system's internal functional hierarchy and functional paths, resulting in a lack of accuracy and operability in risk assessment results. Furthermore, the current dynamic response mechanism does not conduct in-depth analysis of the logical relationships and dependencies between different functional modules, and fails to effectively respond to the infectious risks of vulnerabilities, thus limiting the comprehensiveness and scientific nature of vulnerability response strategies.

[0005] Therefore, in view of the shortcomings of existing technologies in vulnerability response, there is an urgent need for a vulnerability response optimization method and system based on dynamic risk assessment to achieve real-time monitoring of system function paths and functional deviation detection, and then generate accurate vulnerability response strategies based on risk assessment results to reduce system security risks. This method and system can not only improve the timeliness and accuracy of vulnerability response, but also provide technical support for the effective isolation, tracking and repair of vulnerabilities. Summary of the invention

[0006] In order to solve at least one of the above technical problems, the present invention proposes a vulnerability response optimization method and system based on dynamic risk assessment.

[0007] A first aspect of the present invention provides a vulnerability response optimization method based on dynamic risk assessment, comprising: Acquire function level data of the target system, identify function logic paths according to the function level data, and construct a function response dependency graph of the target system according to the function logic paths; Constructing an execution listener for each instance method in the target system code, and identifying a real-time functional response path of the target system during actual use according to the execution listener; Performing path analysis on the real-time function response path based on the function response dependency graph to determine the function response deviation of the target system, and performing a function vulnerability risk assessment on the target system according to the function response deviation to obtain a function vulnerability risk assessment result; An impact analysis is performed on the target system based on the functional vulnerability risk assessment results to determine the vulnerability impact range, and a response is performed to the functional vulnerabilities of the target system based on the vulnerability impact range to build a vulnerability response strategy for the target system.

[0008] In this solution, the function level data of the target system is obtained, the function logic path is identified according to the function level data, and the function response dependency graph of the target system is constructed according to the function logic path, specifically: Acquire function level data of the target system according to the development document of the target system, acquire implementation methods of each function level according to the function level data, and construct function test instructions of the target system according to the implementation methods; Perform a functional test on the target system according to the functional test instruction, and record log data of each functional test during the functional test of the target system, wherein the log data includes an event name, an instance ID, a timestamp, and an execution module; Arranging the log data in chronological order according to the timestamps to generate a structured event log table; According to the event log table, the number of events N occurring in the target system during each functional test process is obtained, an initialization direct predecessor relationship matrix and an initialization direct successor relationship matrix of size N×N are constructed during each functional test process, and all elements of the initialization direct predecessor relationship matrix and the initialization direct successor relationship matrix are set to 0; Traversing adjacent events A and B in the event log table, if the frequency of event A occurring before event B is greater than a first preset frequency value during the target system function test, setting the initialization direct predecessor relationship matrix elements corresponding to event A and event B to 1; If the frequency of event A occurring after event B is greater than a second preset frequency value, the elements of the initialized direct successor relationship matrix corresponding to event A and event B are set to 1, and when the traversal is completed, the initialized direct predecessor relationship matrix and the initialized direct successor relationship matrix are updated to obtain the direct predecessor relationship matrix and the direct successor relationship matrix of the event occurring in the target system; The functional logic path of the target system is determined according to the direct predecessor relationship matrix and the direct successor relationship matrix, and the functional response dependency graph of the target system is constructed according to the functional logic path.

[0009] In this solution, the execution listener of each instance method in the target system code is constructed, and the real-time function response path of the target system in actual use is identified according to the execution listener, specifically: Obtaining execution entry and exit position information of each instance method in the target system code, writing stub codes at the execution entry and exit positions, and constructing an execution listener for each instance method of the target system according to the stub codes; Acquire the execution status of each instance method of the target system in real time during actual use according to the execution listener, wherein the execution status includes execution start time, execution end time, execution start position, execution end position, and execution completeness; According to the execution status of each instance method, the instance method call chain of the target system during actual use is identified, and the real-time function response path of the target system is constructed according to the instance method call chain.

[0010] In this solution, the real-time function response path is analyzed based on the function response dependency graph to determine the function response deviation of the target system, and the function vulnerability risk assessment of the target system is performed according to the function response deviation to obtain the function vulnerability risk assessment result, which is specifically: Building a function response path identification model of the target system based on a decision tree algorithm, importing the function response dependency graph into the function response path identification model to build an execution process decision tree for each function of the target system; Importing the execution process decision tree into the functional response path identification model for training and learning; Acquire function usage information of the target system during actual use, import the function usage information into the trained function response path identification model to perform function response path identification, and obtain a standard function response path of the target system during actual use; Compare the real-time function response path with the standard function response path to determine the function response deviation of the target system during actual use, wherein the function response deviation includes the function response deviation type and the deviation position, and the function response deviation type includes function module crosstalk, function module call sequence deviation, resource competition, function module call redundancy, and unknown function module call; A functional vulnerability risk assessment is performed on the target system according to the functional response deviation to obtain a functional vulnerability risk assessment result.

[0011] In this solution, the impact surface analysis of the target system is performed according to the functional vulnerability risk assessment results to determine the vulnerability impact range, respond to the functional vulnerability of the target system according to the vulnerability impact range, and build a vulnerability response strategy for the target system, specifically: Preset a functional vulnerability risk threshold, and mark the target system function whose functional vulnerability risk is greater than the functional vulnerability risk threshold as a function to be responded to; Perform vulnerability impact analysis on the vulnerability response function according to the function response dependency graph, identify the vulnerability propagation path when the vulnerability of the vulnerability response function occurs, and determine the vulnerability impact function module according to the vulnerability propagation path; Determine whether the vulnerability-affecting function module is a shared function module of other functions in the target system according to the function response dependency graph; if not, mark the function to be responded to as a non-vulnerability-infectious function; Obtaining user usage frequency data of the non-vulnerability infectious function, evaluating the repair urgency of the non-vulnerability infectious function according to the user usage frequency data, and performing a real-time vulnerability warning operation on the non-vulnerability infectious function if the repair urgency is greater than a preset urgency; If the repair urgency is not greater than the preset urgency, the non-vulnerability infectious function is functionally isolated, the target system's operating load data within a historical preset time period is obtained, the target system's low-load operating time period is identified according to the operating load data, the low-load operating time period is used as the recommended vulnerability repair time period for the non-vulnerability infectious function to form vulnerability warning information and sent to the system administrator device to obtain a first vulnerability response strategy; If the vulnerability-affected function module is a shared function module of other functions in the target system, the function to be responded to the vulnerability is marked as a vulnerability infectious function, and a vulnerability tracking response is performed on the vulnerability infectious function to obtain a second vulnerability response strategy; A vulnerability response plan is constructed according to the first vulnerability response strategy and the second vulnerability response strategy to optimize the vulnerability response of the target system.

[0012] In this solution, the vulnerability tracking response is performed on the vulnerability infectious function to obtain a second vulnerability response strategy, which is specifically: Acquire the function that shares the vulnerability-affected function module in the target system, mark it as the vulnerability-infected function, and obtain the security impact data of the vulnerability-infected function on user operations in the vulnerability-infected state; Real-time isolation of vulnerability-infected functions whose security impact is higher than the preset safety value, and operation risk warnings for other functions; The vulnerability location of the vulnerability infectious function is identified according to the functional response deviation, the functional module of the vulnerability location is disabled in real time, and disconnected from other functional modules, the vulnerability location is repaired in real time, and when the repair is completed, the contact function is isolated and the functional module of the vulnerability location is reconnected with other functional modules to obtain a second vulnerability response strategy.

[0013] The second aspect of the present invention further provides a vulnerability response optimization system based on dynamic risk assessment, the system comprising: a memory, a processor, the memory comprising a vulnerability response optimization method program based on dynamic risk assessment, and when the vulnerability response optimization method program based on dynamic risk assessment is executed by the processor, the following steps are implemented: Acquire function level data of the target system, identify function logic paths according to the function level data, and construct a function response dependency graph of the target system according to the function logic paths; Constructing an execution listener for each instance method in the target system code, and identifying a real-time functional response path of the target system during actual use according to the execution listener; Performing path analysis on the real-time function response path based on the function response dependency graph to determine the function response deviation of the target system, and performing a function vulnerability risk assessment on the target system according to the function response deviation to obtain a function vulnerability risk assessment result; An impact analysis is performed on the target system based on the functional vulnerability risk assessment results to determine the vulnerability impact range, and a response is performed to the functional vulnerabilities of the target system based on the vulnerability impact range to build a vulnerability response strategy for the target system.

[0014] The present invention discloses a vulnerability response optimization method and system based on dynamic risk assessment. The present invention includes: obtaining the function level data of the target system, identifying the function logic path and constructing the function response dependency graph; setting the execution listener of the instance method, identifying the real-time function response path in the actual use of the system; performing path analysis on the real-time response path based on the function dependency graph, determining the function response deviation and performing function vulnerability risk assessment, and generating risk assessment results; analyzing the vulnerability impact range based on the risk assessment results, and formulating a vulnerability response strategy accordingly. The present invention realizes the dynamic assessment of the function vulnerability risk in the system operation, improves the accuracy and timeliness of the vulnerability response, and reduces the system security risk. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A flow chart of a vulnerability response optimization method based on dynamic risk assessment of the present invention is shown; Figure 2 A flow chart showing the present invention for identifying a real-time function response path; Figure 3 A flow chart showing the present invention for obtaining a second vulnerability response strategy; Figure 4 A block diagram of a vulnerability response optimization system based on dynamic risk assessment of the present invention is shown. DETAILED DESCRIPTION

[0016] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0017] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0018] Figure 1 A flow chart of a vulnerability response optimization method based on dynamic risk assessment of the present invention is shown.

[0019] like Figure 1 As shown, the first aspect of the present invention provides a vulnerability response optimization method based on dynamic risk assessment, comprising: S102, acquiring function level data of the target system, identifying function logic paths according to the function level data, and constructing a function response dependency graph of the target system according to the function logic paths; S104, constructing an execution listener for each instance method in the target system code, and identifying a real-time functional response path of the target system during actual use according to the execution listener; S106, performing path analysis on the real-time function response path based on the function response dependency graph, determining the function response deviation of the target system, and performing a function vulnerability risk assessment on the target system according to the function response deviation to obtain a function vulnerability risk assessment result; S108, performing an impact analysis on the target system according to the functional vulnerability risk assessment result, determining the vulnerability impact scope, responding to the functional vulnerability of the target system according to the vulnerability impact scope, and building a vulnerability response strategy for the target system.

[0020] It should be noted that by obtaining the functional hierarchical data of the target system, the functional logic path of the target system is determined and a functional response dependency graph is constructed. The construction of the functional response dependency graph can clearly show the logical relationship between the functional modules of the system. Through the dependency graph, the degree of association and the scope of influence of each module can be quickly understood, which helps to accurately identify the risk propagation path that may be caused; the execution listener is constructed by building each instance method in the target system code. The listener collects the timestamp, call sequence, module location and other data of the method call in real time to identify the function call link of the system in the actual operation process and generate a real-time functional response path. The real-time functional response path reflects the actual call behavior of the target system in the actual user use process, which helps to accurately identify the abnormal call chain or functional deviation that may occur in the system operation; the functional response deviation of the real-time functional response path is identified through the functional response dependency graph, and the risk of vulnerability of the target system function is determined according to the functional response deviation. Then, the functional vulnerability response is carried out according to the risk of functional vulnerability, and the vulnerability response strategy is constructed to ensure the efficiency and accuracy of the vulnerability response. The response strategy can effectively reduce the possibility of vulnerability propagation, isolate high-risk functional modules in time, and prevent the vulnerability from affecting other modules.

[0021] According to an embodiment of the present invention, the acquiring of function level data of the target system, identifying a function logic path according to the function level data, and constructing a function response dependency graph of the target system according to the function logic path is specifically as follows: Acquire function level data of the target system according to the development document of the target system, acquire implementation methods of each function level according to the function level data, and construct function test instructions of the target system according to the implementation methods; Perform a functional test on the target system according to the functional test instruction, and record log data of each functional test during the functional test of the target system, wherein the log data includes an event name, an instance ID, a timestamp, and an execution module; It should be noted that the functional hierarchy data refers to the functions and sub-functions that can be operated by users on the target system; the event name is the module execution name or operation name of the system during the test of each function. A function can have multiple function execution modules. In the target system, the function execution module can be executed or called by multiple functions. The function execution module is a piece of code, that is, an instance method in the code, or a sub-function module in the target system. The function module in the application of the present invention is the above-mentioned function execution module, and one function is composed of multiple function modules.

[0022] Arranging the log data in chronological order according to the timestamps to generate a structured event log table; According to the event log table, the number of events N occurring in the target system during each functional test process is obtained, an initialization direct predecessor relationship matrix and an initialization direct successor relationship matrix of size N×N are constructed during each functional test process, and all elements of the initialization direct predecessor relationship matrix and the initialization direct successor relationship matrix are set to 0; Traversing adjacent events A and B in the event log table, if the frequency of event A occurring before event B is greater than a first preset frequency value during the target system function test, setting the initialization direct predecessor relationship matrix elements corresponding to event A and event B to 1; If the frequency of event A occurring after event B is greater than a second preset frequency value, set the elements of the initialized direct successor relationship matrix corresponding to event A and event B to 1, and update the initialized direct predecessor relationship matrix and the initialized direct successor relationship matrix after the traversal is completed to obtain the direct predecessor relationship matrix and the direct successor relationship matrix of the event occurring in the target system; It should be noted that by analyzing the implementation method of each function of the target system, constructing the function test instructions of each function, testing each function of the target system according to the function test instructions, obtaining the log data in the function test process, and constructing the event log table, analyzing the event log table, constructing the direct predecessor relationship matrix and the direct successor relationship matrix of the event occurrence in the target system, the direct predecessor means that one event occurs directly before another event. In the log, for each pair of events, if event A always (that is, the frequency of occurrence is greater than the first preset frequency value) occurs before event B, then A is the direct predecessor of B. The direct successor means that one event occurs directly after another event. The calculation method of the direct successor relationship is similar to that of the direct predecessor, but in the opposite direction. The direct predecessor relationship matrix records the relationship between which functional modules appear frequently before other functional modules (that is, the predecessor relationship between modules). Similarly, the direct successor relationship matrix records the relationship between which modules appear frequently after other modules (that is, the successor relationship). By setting the frequency threshold, the stable front and back relationships can be accurately screened out, thereby reflecting the order information of the functional modules of the system in the actual calling process.

[0023] The functional logic path of the target system is determined according to the direct predecessor relationship matrix and the direct successor relationship matrix, and the functional response dependency graph of the target system is constructed according to the functional logic path.

[0024] It should be noted that when the predecessor matrix and the successor matrix are combined, a directed graph of a functional module can be formed. The path in the graph is the logical dependency relationship between the modules. Therefore, the predecessor and successor relationship matrices can systematically present the function call sequence of all modules and determine the functional logic path in the system. In the matrix, only those predecessor or successor relationships whose frequency reaches the preset threshold will be recorded, which effectively avoids the interference of accidental events, thereby ensuring that the generated functional logic path has high accuracy and stability; the functional logic path not only shows the functional sequence relationship of the system, but also shows the dependency links between functional modules. Therefore, through the predecessor and successor relationship matrix, a complete dependency graph or functional logic path graph can be constructed; the functional logic path is the sequence or parallel execution order between the functional submodules or instance methods in the code that need to be executed when a function is executed in the target system; the functional response dependency graph is a graphical model used to describe the mutual dependency relationship between various functional modules or instance methods in the system and their execution order. It mainly reflects how various functions (such as services, modules, components, instance methods, etc.) in the system depend on each other, interact and respond in order. Each node represents an instance method of a functional module or code, and the edge represents the calling relationship. It shows the calling path and hierarchical relationship between modules.

[0025] Figure 2 A flow chart of identifying a real-time function response path according to the present invention is shown.

[0026] According to an embodiment of the present invention, the execution listener of each instance method in the target system code is constructed, and the real-time function response path of the target system in actual use is identified according to the execution listener, specifically: S202, obtaining execution entry and exit position information of each instance method in the target system code, writing stub codes at the execution entry and exit positions, and constructing an execution listener for each instance method of the target system according to the stub codes; S204, obtaining in real time according to the execution listener the execution status of each instance method of the target system during actual use, wherein the execution status includes execution start time, execution end time, execution start position, execution end position, and execution completeness; S206, identifying the instance method call chain of the target system during actual use according to the execution status of each instance method, and constructing the real-time function response path of the target system according to the instance method call chain.

[0027] It should be noted that by constructing the stub code and execution listener for each instance method in the target system, the execution status of each method can be accurately captured when the system is running, including the calling order and execution completeness of the method; based on the execution status of the instance method, the call chain of the system in actual use can be dynamically generated. This call chain directly reflects the real-time dependency and calling order between the functional modules. The establishment of the real-time functional response path enables the system to promptly detect abnormal path deviations or anomalies in the call chain. For example, if the calling order of a functional module is abnormal, or a method that should not be repeated is called repeatedly, these can be reflected in the path. An instance method represents a functional module. The stub code is a technology used to add additional code to the program. These codes help developers monitor, analyze or debug the execution process of the program without changing the original business logic.

[0028] According to an embodiment of the present invention, the real-time function response path is analyzed based on the function response dependency graph to determine the function response deviation of the target system, and the function vulnerability risk assessment of the target system is performed according to the function response deviation to obtain the function vulnerability risk assessment result, which is specifically: Building a function response path identification model of the target system based on a decision tree algorithm, importing the function response dependency graph into the function response path identification model to build an execution process decision tree for each function of the target system; Importing the execution process decision tree into the functional response path identification model for training and learning; Acquire function usage information of the target system during actual use, import the function usage information into the trained function response path identification model to perform function response path identification, and obtain a standard function response path of the target system during actual use; Compare the real-time function response path with the standard function response path to determine the function response deviation of the target system during actual use, wherein the function response deviation includes the function response deviation type and the deviation position, and the function response deviation type includes function module crosstalk, function module call sequence deviation, resource competition, function module call redundancy, and unknown function module call; A functional vulnerability risk assessment is performed on the target system according to the functional response deviation to obtain a functional vulnerability risk assessment result.

[0029] It should be noted that by introducing the decision tree algorithm to construct the function response path identification model of the target system, the decision tree algorithm can perform process analysis on the function response dependency graph, and then construct each function process into an execution process decision tree. A decision tree represents the execution process of a function module during the use of a function; by importing the function usage information of the target system during actual use into the function response path identification model to identify the function response path, the function response path identification model can analyze the function usage module and output the standard execution path of the function module of the target system during the function use, that is, the standard function response path; by comparing the real-time function response path with the standard function response path, the response deviation of the function module of the target system function during actual use can be identified. The greater the response deviation, the greater the risk of a vulnerability in the function; by identifying and evaluating the function response deviation, the system can effectively defend before the vulnerability is actually exploited by malicious attackers, reducing the time window in which the system is exposed to the attack surface. This helps to improve the overall system's defense capabilities and reduce the chances of attackers exploiting vulnerabilities to invade; the function usage information refers to the function usage type and data input status of the target system during actual use; the function module is a sub-module or instance method for building a complete function. Each function must be composed of multiple function modules to operate normally.

[0030] According to an embodiment of the present invention, the impact surface analysis of the target system is performed according to the functional vulnerability risk assessment result, the vulnerability impact range is determined, the functional vulnerability of the target system is responded to according to the vulnerability impact range, and the vulnerability response strategy of the target system is constructed, specifically: Preset a functional vulnerability risk threshold, and mark the target system function whose functional vulnerability risk is greater than the functional vulnerability risk threshold as a function to be responded to; Perform vulnerability impact analysis on the vulnerability response function according to the function response dependency graph, identify the vulnerability propagation path when the vulnerability of the vulnerability response function occurs, and determine the vulnerability impact function module according to the vulnerability propagation path; Determine whether the vulnerability-affecting function module is a shared function module of other functions in the target system according to the function response dependency graph; if not, mark the function to be responded to as a non-vulnerability-infectious function; It should be noted that by marking the target system functions with vulnerability risks greater than the functional risk threshold as the functions to be responded to, the functional modules that pose a greater threat to system security can be efficiently focused on. This ensures that vulnerability response resources are concentrated on the most critical functions, avoids redundant processing, and improves the efficiency of vulnerability response; based on the functional response dependency graph, the impact surface analysis of the functions to be responded to can identify the propagation path when the vulnerability occurs and accurately determine the impact range of the vulnerability. In this way, when the vulnerability occurs, the functional modules affected by the vulnerability can be located in time; since the functional modules in the target system may be called by multiple functions, when the functional modules affected by the vulnerability are shared functional modules of other functions, other functions will cause vulnerabilities in other functions due to the vulnerabilities of the functions to be responded to. When the vulnerability-affecting functional modules of the functions to be responded to do not affect other functions, it means that the vulnerability will not be transmitted to other functions, and it is marked as a non-vulnerability infectious function, which is the function to be responded to. When the vulnerability occurs, the function will not affect other functions of the target system, but only affect the use of the function to be responded to.

[0031] Obtaining user usage frequency data of the non-vulnerability infectious function, evaluating the repair urgency of the non-vulnerability infectious function according to the user usage frequency data, and performing a real-time vulnerability warning operation on the non-vulnerability infectious function if the repair urgency is greater than a preset urgency; If the repair urgency is not greater than the preset urgency, the non-vulnerability infectious function is functionally isolated, the target system's operating load data within a historical preset time period is obtained, the target system's low-load operating time period is identified according to the operating load data, the low-load operating time period is used as the recommended vulnerability repair time period for the non-vulnerability infectious function to form vulnerability warning information and sent to the system administrator device to obtain a first vulnerability response strategy; If the vulnerability-affected function module is a shared function module of other functions in the target system, the function to be responded to the vulnerability is marked as a vulnerability infectious function, and a vulnerability tracking response is performed on the vulnerability infectious function to obtain a second vulnerability response strategy; A vulnerability response plan is constructed according to the first vulnerability response strategy and the second vulnerability response strategy to optimize the vulnerability response of the target system.

[0032] It should be noted that by analyzing the frequency of user use of non-vulnerability infectious functions, the urgency of their repair can be dynamically evaluated. This can avoid overly tense vulnerability repairs, thereby ensuring that the repair priority is reasonable, and making flexible adjustments based on the urgency of the repair, ensuring that repairs are made as early as possible when necessary, and combining historical operating load data to identify the low-load time period of the system, providing the best time window for vulnerability repairs of non-vulnerability infectious functions, avoiding repairs when the system load is too high, reducing the interference of repair operations on the business, and improving the stability of the system. When the repair urgency is high, the system can send alarm information to the administrator through real-time vulnerability warning operations. This helps administrators take measures before the vulnerability occurs, reduce the time the system is exposed to potential attacks, and improve security protection capabilities. The combination of real-time vulnerability warnings and functional isolation can take preventive measures before emergency repairs, reduce the spread and impact of vulnerabilities, and provide a sufficient time window for vulnerability repairs. The functional isolation is the use of the suspension function.

[0033] Figure 3 A flow chart of obtaining a second vulnerability response strategy according to the present invention is shown.

[0034] According to an embodiment of the present invention, the vulnerability tracing response is performed on the vulnerability infectious function to obtain a second vulnerability response strategy, which is specifically: S302, obtaining a function in the target system that shares the vulnerability-affected function module, marking it as a vulnerability-infected function, and obtaining security impact data of the vulnerability-infected function on user operations in a vulnerability-infected state; S304, real-time isolation of the functions infected by the vulnerability whose security impact is higher than the preset security value, and operation risk warnings for other functions; S306, identifying the vulnerability location of the vulnerability infectious function according to the functional response deviation, disabling the functional module of the vulnerability location in real time, and disconnecting it from other functional modules, repairing the vulnerability location in real time, and after the repair is completed, isolating the contact function and reconnecting the functional module of the vulnerability location with other functional modules to obtain a second vulnerability response strategy.

[0035] It should be noted that by obtaining the functions of the shared vulnerability-affected function modules in the target system and marking them as "vulnerable functions", it is possible to effectively identify which functions may be affected by the spread of vulnerabilities. This identification helps determine which function modules are potential security threats and makes vulnerability responses more targeted. The security impact of the functions infected by the vulnerabilities is evaluated, and especially when the security impact of these functions exceeds the preset security value, the system can immediately isolate the functions. This can prevent the further spread of vulnerabilities, protect the system from the spread of potential risks, and improve overall security; for the functions infected by the vulnerabilities that do not reach the high security impact threshold, the system can provide operational risk prompts to remind users of potential operational risks. According to the vulnerability location, the system can disable the relevant function modules in real time and disconnect them from other function modules to reduce the possibility of continued propagation of the vulnerability. This isolation method can effectively prevent the spread of vulnerabilities and ensure that the system remains stable during the vulnerability repair period.

[0036] According to an embodiment of the present invention, it also includes: Obtaining the working status of each instance method execution listener of the target system during actual use, and obtaining performance overhead data of the execution listener according to the working status; Acquire efficiency impact data of the performance overhead of the execution listener on the monitoring efficiency, and acquire the response speed impact data of different monitoring efficiencies on the vulnerability response according to the efficiency impact data; Determine the response speed requirement data of the target system to respond to the current functional vulnerability risk according to the functional vulnerability risk assessment result; Calculate the real-time response speed of the target system to the vulnerability response according to the performance overhead data, efficiency impact data, and response speed impact data; Compare the real-time response speed with the response speed requirement data to determine whether the current response speed of the target system meets the response speed requirement; if not, identify the vulnerability-affecting function module of the current functional vulnerability, obtain the instance method location information corresponding to the vulnerability-affecting function module, and reduce the execution monitoring frequency operation of the instance method corresponding to the non-vulnerability-affecting function module according to the instance method location information; Obtaining performance overhead data of the execution listener after the execution monitoring frequency is reduced, and calculating the optimized response speed of the real-time system to the vulnerability response according to the performance overhead data of the execution listener after the execution monitoring frequency is reduced; If the optimized response speed still does not meet the response speed requirement, the instance methods corresponding to the functional modules affected by the vulnerability are numbered according to the standard functional response paths, and the instance methods are grouped according to odd and even numbers. The instance methods in each group are monitored alternately according to a preset time period to obtain a vulnerability response speed optimization plan.

[0037] It should be noted that modern software systems, especially large distributed systems, often contain hundreds or thousands of functional modules, each of which has a large number of instance methods. When the system needs to monitor these modules and methods in real time, the system's performance overhead will rise sharply, affecting the vulnerability response speed and preventing the vulnerability from being quickly warned. By monitoring the execution listener work of each instance method in the system, the performance overhead data of these listeners are collected in real time. The performance overhead data includes the amount of computing resources consumed by the listener on system resources (such as CPU and memory). The impact of the listener performance overhead on its work efficiency is further analyzed. For example, in the case of high performance overhead, the monitoring efficiency may be reduced. The monitoring efficiency here refers to the ability of the listener to accurately collect functional path information, including timely response to vulnerability events. Through these data, the relationship between performance overhead and monitoring efficiency can be quantified. Based on the efficiency impact data of the listener, the vulnerability response speed under different monitoring efficiencies is analyzed and predicted. For example, if the monitoring efficiency decreases, it may take the system longer to detect and respond to a specific vulnerability. According to the functional vulnerability risk assessment results, the system's response speed requirements for the current vulnerability are determined. High-risk vulnerabilities require faster response speeds. The real-time response speed of the system is calculated using performance overhead data, monitoring efficiency impact data, and the current response speed requirements. The calculated real-time response speed is compared with the response speed requirements to determine whether the current vulnerability response speed can meet the requirements. If not, the monitoring frequency of instance methods of non-influencing functional modules that are not related to the vulnerability will be reduced to reduce system overhead, so that more resources can be used to monitor modules affected by the vulnerability and improve the response efficiency of the system. If the response speed still does not meet the requirements after reducing the monitoring frequency of non-influencing modules, the monitoring strategy will be further optimized. The specific operation is to divide the instance methods of the affecting functional modules into two groups of instance methods with odd and even numbers according to the numbering of the standard functional response path, and monitor each group of methods alternately. Alternating monitoring reduces the burden of a single monitoring and ensures that the critical path of the vulnerability-affecting module is still running under control. This alternating monitoring allows the system to allocate more reasonable resources and optimize the vulnerability response speed while ensuring the accuracy of vulnerability detection. Alternating monitoring means monitoring the odd group in the current time period and monitoring the even group in the next time period.

[0038] Figure 4 A block diagram of a vulnerability response optimization system based on dynamic risk assessment of the present invention is shown.

[0039] The second aspect of the present invention further provides a vulnerability response optimization system 4 based on dynamic risk assessment, the system comprising: a memory 41, a processor 42, the memory comprising a vulnerability response optimization method program based on dynamic risk assessment, the vulnerability response optimization method program based on dynamic risk assessment being executed by the processor to implement the following steps: Acquire function level data of the target system, identify function logic paths according to the function level data, and construct a function response dependency graph of the target system according to the function logic paths; Constructing an execution listener for each instance method in the target system code, and identifying a real-time functional response path of the target system during actual use according to the execution listener; Performing path analysis on the real-time function response path based on the function response dependency graph to determine the function response deviation of the target system, and performing a function vulnerability risk assessment on the target system according to the function response deviation to obtain a function vulnerability risk assessment result; An impact analysis is performed on the target system based on the functional vulnerability risk assessment results to determine the vulnerability impact range, and a response is performed to the functional vulnerabilities of the target system based on the vulnerability impact range to build a vulnerability response strategy for the target system.

[0040] The present invention discloses a vulnerability response optimization method and system based on dynamic risk assessment. The present invention includes: obtaining the function level data of the target system, identifying the function logic path and constructing the function response dependency graph; setting the execution listener of the instance method, identifying the real-time function response path in the actual use of the system; performing path analysis on the real-time response path based on the function dependency graph, determining the function response deviation and performing function vulnerability risk assessment, and generating risk assessment results; analyzing the vulnerability impact range based on the risk assessment results, and formulating a vulnerability response strategy accordingly. The present invention realizes the dynamic assessment of the function vulnerability risk in the system operation, improves the accuracy and timeliness of the vulnerability response, and reduces the system security risk.

[0041] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0042] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0043] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0044] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0045] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0046] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A vulnerability response optimization method based on dynamic risk assessment, characterized in that: The following steps are involved: Acquire function level data of the target system, identify function logic paths according to the function level data, and construct a function response dependency graph of the target system according to the function logic paths; Building an execution listener for each instance method in the target system code, and identifying a real-time functional response path of the target system during actual use according to the execution listener; Performing path analysis on the real-time function response path based on the function response dependency graph to determine the function response deviation of the target system, and performing a function vulnerability risk assessment on the target system according to the function response deviation to obtain a function vulnerability risk assessment result; An impact analysis is performed on the target system based on the functional vulnerability risk assessment results to determine the vulnerability impact range, and a response is performed to the functional vulnerabilities of the target system based on the vulnerability impact range to build a vulnerability response strategy for the target system.

2. A vulnerability response optimization method based on dynamic risk assessment according to claim 1, characterized in that: The acquiring of the function level data of the target system, identifying the function logic path according to the function level data, and constructing the function response dependency graph of the target system according to the function logic path, is specifically as follows: Acquire function level data of the target system according to the development document of the target system, acquire implementation methods of each function level according to the function level data, and construct function test instructions of the target system according to the implementation methods; Perform a functional test on the target system according to the functional test instruction, and record log data of each functional test during the functional test of the target system, wherein the log data includes an event name, an instance ID, a timestamp, and an execution module; Arranging the log data in chronological order according to the timestamps to generate a structured event log table; According to the event log table, the number of events N occurring in the target system during each functional test process is obtained, an initialization direct predecessor relationship matrix and an initialization direct successor relationship matrix of size N×N are constructed during each functional test process, and all elements of the initialization direct predecessor relationship matrix and the initialization direct successor relationship matrix are set to 0; Traversing adjacent events A and B in the event log table, if the frequency of event A occurring before event B is greater than a first preset frequency value during the target system function test, setting the initialization direct predecessor relationship matrix elements corresponding to event A and event B to 1; If the frequency of event A occurring after event B is greater than a second preset frequency value, the elements of the initialized direct successor relationship matrix corresponding to event A and event B are set to 1, and when the traversal is completed, the initialized direct predecessor relationship matrix and the initialized direct successor relationship matrix are updated to obtain the direct predecessor relationship matrix and the direct successor relationship matrix of the event occurring in the target system; The functional logic path of the target system is determined according to the direct predecessor relationship matrix and the direct successor relationship matrix, and the functional response dependency graph of the target system is constructed according to the functional logic path.

3. According to claim 1, a vulnerability response optimization method based on dynamic risk assessment is characterized in that: The execution listener of each instance method in the target system code is constructed, and the real-time function response path of the target system in actual use is identified according to the execution listener, specifically: Obtaining execution entry and exit position information of each instance method in the target system code, writing stub codes at the execution entry and exit positions, and constructing an execution listener for each instance method of the target system according to the stub codes; Acquire the execution status of each instance method of the target system in real time during actual use according to the execution listener, wherein the execution status includes execution start time, execution end time, execution start position, execution end position, and execution completeness; According to the execution status of each instance method, the instance method call chain of the target system during actual use is identified, and the real-time function response path of the target system is constructed according to the instance method call chain.

4. The vulnerability response optimization method based on dynamic risk assessment according to claim 1 is characterized in that: The path analysis is performed on the real-time function response path based on the function response dependency graph to determine the function response deviation of the target system, and the function vulnerability risk assessment is performed on the target system according to the function response deviation to obtain the function vulnerability risk assessment result, specifically: Building a function response path identification model of the target system based on a decision tree algorithm, importing the function response dependency graph into the function response path identification model to build an execution process decision tree for each function of the target system; Importing the execution process decision tree into the functional response path identification model for training and learning; Acquire function usage information of the target system during actual use, import the function usage information into the trained function response path identification model to perform function response path identification, and obtain a standard function response path of the target system during actual use; Compare the real-time function response path with the standard function response path to determine the function response deviation of the target system during actual use, wherein the function response deviation includes the function response deviation type and the deviation position, and the function response deviation type includes function module crosstalk, function module call sequence deviation, resource competition, function module call redundancy, and unknown function module call; A functional vulnerability risk assessment is performed on the target system according to the functional response deviation to obtain a functional vulnerability risk assessment result.

5. A vulnerability response optimization method based on dynamic risk assessment according to claim 4, characterized in that: The target system is analyzed for impact according to the functional vulnerability risk assessment result, the vulnerability impact range is determined, the functional vulnerability of the target system is responded to according to the vulnerability impact range, and the vulnerability response strategy of the target system is constructed, specifically: Preset a functional vulnerability risk threshold, and mark the target system function whose functional vulnerability risk is greater than the functional vulnerability risk threshold as a function to be responded to; Perform vulnerability impact analysis on the vulnerability response function according to the function response dependency graph, identify the vulnerability propagation path when the vulnerability of the vulnerability response function occurs, and determine the vulnerability impact function module according to the vulnerability propagation path; Determine whether the vulnerability-affecting function module is a shared function module of other functions in the target system according to the function response dependency graph; if not, mark the function to be responded to as a non-vulnerability-infectious function; Obtaining user usage frequency data of the non-vulnerability infectious function, evaluating the repair urgency of the non-vulnerability infectious function according to the user usage frequency data, and performing a real-time vulnerability warning operation on the non-vulnerability infectious function if the repair urgency is greater than a preset urgency; If the repair urgency is not greater than the preset urgency, the non-vulnerability infectious function is functionally isolated, the target system's operating load data within a historical preset time period is obtained, the target system's low-load operating time period is identified according to the operating load data, the low-load operating time period is used as the recommended vulnerability repair time period for the non-vulnerability infectious function to form vulnerability warning information and sent to the system administrator device to obtain a first vulnerability response strategy; If the vulnerability-affected function module is a shared function module of other functions in the target system, the function to be responded to the vulnerability is marked as a vulnerability infectious function, and a vulnerability tracking response is performed on the vulnerability infectious function to obtain a second vulnerability response strategy; A vulnerability response plan is constructed according to the first vulnerability response strategy and the second vulnerability response strategy to optimize the vulnerability response of the target system.

6. A vulnerability response optimization method based on dynamic risk assessment according to claim 5, characterized in that: The vulnerability tracking response is performed on the vulnerability infectious function to obtain a second vulnerability response strategy, which is specifically: Acquire the function that shares the vulnerability-affected function module in the target system, mark it as the vulnerability-infected function, and obtain the security impact data of the vulnerability-infected function on user operations in the vulnerability-infected state; Real-time isolation of vulnerability-infected functions whose security impact is higher than the preset safety value, and operation risk warnings for other functions; The vulnerability location of the vulnerability infectious function is identified according to the functional response deviation, the functional module of the vulnerability location is disabled in real time, and disconnected from other functional modules, the vulnerability location is repaired in real time, and when the repair is completed, the contact function is isolated and the functional module of the vulnerability location is reconnected with other functional modules to obtain a second vulnerability response strategy.

7. A vulnerability response optimization system based on dynamic risk assessment, characterized in that: The vulnerability response optimization system based on dynamic risk assessment includes a storage device and a processor. The storage device includes a vulnerability response optimization method program based on dynamic risk assessment. When the vulnerability response optimization method program based on dynamic risk assessment is executed by the processor, the following steps are implemented: Acquire function level data of the target system, identify function logic paths according to the function level data, and construct a function response dependency graph of the target system according to the function logic paths; Constructing an execution listener for each instance method in the target system code, and identifying a real-time functional response path of the target system during actual use according to the execution listener; Performing path analysis on the real-time function response path based on the function response dependency graph to determine the function response deviation of the target system, and performing a function vulnerability risk assessment on the target system according to the function response deviation to obtain a function vulnerability risk assessment result; An impact analysis is performed on the target system based on the functional vulnerability risk assessment results to determine the vulnerability impact range, and a response is performed to the functional vulnerabilities of the target system based on the vulnerability impact range to build a vulnerability response strategy for the target system.

Images